KR102329493B1 - Method and apparatus for preventing connection in wireless intrusion prevention system - Google Patents

Abstract

The present invention relates to a method for blocking access of an electronic device in a wireless intrusion prevention system, comprising: sequentially monitoring a wireless frame in a plurality of channels through a first communication module; generating a first blocking message based on at least one radio frame received as a result of the monitoring, and generating a second blocking message based on a first radio frame to which a predetermined radio network technology is applied among the at least one radio frame; and transmitting at least one of the first and second blocking messages through a second communication module. However, it is not limited to the above embodiment, and other embodiments are possible.

Description

Method and device for blocking access in wireless intrusion prevention system

The present invention relates to a wireless intrusion prevention system, and to a method and apparatus for blocking access between an access point (AP) and a terminal.

With the rapid development and dissemination of the Internet, the network environment is getting bigger and bigger, and the form is getting complicated due to the simple and convenient network access and various services provided by the Internet. However, due to various types of network attacks such as viruses, hacking, system intrusion, system administrator privilege acquisition, intrusion concealment, denial of service attack, etc. Public institutions, infrastructure, and financial institutions are increasingly affected by the damage. In order to solve these Internet security problems, the need for network security technologies such as antivirus, firewall, integrated security management, and intrusion detection system is emerging.

A wireless LAN system for wireless Internet communication includes a wireless LAN access point (AP) and a wireless LAN terminal. The AP installs and uses a device called an access point device. The wireless LAN terminal receives the information provided by the AP and provides it to the next stage. Since the APs currently mainly used provide only wireless traffic transmission and network support functions, they cannot filter out hacking information that enters into the wireless network.

Recently, an integrated network system using wired and wireless has been widely developed and applied. It is difficult to reliably block harmful traffic accessing by wire, but it is even more difficult to reliably block harmful traffic accessing wirelessly. To solve this problem, a Wireless Intrusion Prevention System (WIPS) is being developed. WIPS is a system that detects and blocks wireless intrusions such as rouge APs or Denial of Service (DoS) attacks through wireless section monitoring.

For example, when the AP and the terminal are connected through a protected non-authentication frame as in IEEE 802.11w technology, the WIPS may block while the AP and the terminal are connected. In addition, if the connection time between the AP and the terminal attempting access is earlier than the time for generating a blocking event, a problem may occur that blocking cannot be performed normally.

Accordingly, various embodiments of the present invention have an object to provide a method of quickly pre-blocking a connection between an AP and a terminal attempting to access through a wireless network to which a predetermined security technology is applied.

A method for blocking access of an electronic device in a wireless intrusion prevention system according to an embodiment of the present invention includes: sequentially monitoring radio frames in a plurality of channels through a first communication module; generating a first blocking message based on at least one radio frame received as a result of the monitoring, and generating a second blocking message based on a first radio frame to which a predetermined radio network technology is applied among the at least one radio frame; and transmitting at least one of the first and second blocking messages through a second communication module.

An electronic device in a wireless intrusion prevention system according to an embodiment of the present invention includes: a first communication module; a second communication module; and controlling to sequentially monitor radio frames in a plurality of channels through the first communication module, generating a first blocking message based on at least one radio frame received as a result of the monitoring, and generating a predetermined one of the at least one radio frame. and a controller that generates a second block message based on the first radio frame to which the radio network technology is applied, and controls to transmit at least one of the first block message and the second block message through a second communication module.

According to the WIPS according to various embodiments of the present invention, it is possible to block the connection between the AP and the terminal connected through the general wireless network, and to pre-access the AP and the terminal through the wireless network to which a predetermined security technology is applied. can be blocked

1 is a block diagram showing the schematic configuration of a wireless intrusion prevention system (wireless intrusion prevention system, WIPS).
2 is a flowchart illustrating a WIPS access blocking method.
3 is a flowchart illustrating a method of determining whether a policy is violated based on a radio frame monitored by a sensing device.
4 is a block diagram showing a schematic configuration of a WIPS according to an embodiment of the present invention.
5 is a diagram illustrating an example of a configuration of a communication module in a sensing device.
6 is a flowchart illustrating a WIPS access blocking method according to an embodiment of the present invention.
7 is a diagram for explaining dynamic allocation of scan channels when monitoring a channel of a sensing device according to an embodiment of the present invention.
8 is a flowchart illustrating a method for dynamically allocating scan channels according to an embodiment of the present invention.
9 is a flowchart illustrating a method for generating a blocking event by a sensing device in relation to a predetermined wireless network according to an embodiment of the present invention.
10 is a flowchart illustrating a method for generating a blocking event by a sensing device in relation to a general wireless network according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. At this time, it should be noted that in the accompanying drawings, the same components are denoted by the same reference numerals as much as possible. In addition, detailed descriptions of well-known functions and configurations that may obscure the gist of the present invention will be omitted.

A wireless intrusion prevention system (WIPS) according to an embodiment of the present invention detects and blocks wireless intrusions such as an unauthorized (rouge) AP (Access Point) or DoS (Denial of Service) attack through wireless section monitoring. is a system that

The general wireless network described in this specification may refer to a wireless network to which IEEE 802.11 technology is applied, and among them, a wireless network to which a predetermined security technology is applied may refer to a wireless network to which IEEE 802.11w technology is applied. IEEE 802.11w is a modification technology of IEEE 802.11 that improves the security of the management frame. However, the present invention is not limited thereto, and of course, embodiments of the present invention may be applied to a wireless network to which various security technologies are applied.

1 is a block diagram showing a schematic configuration of WIPS.

Referring to FIG. 1 , the WIPS may include a sensing device 100 and a server 130 . Meanwhile, in a corporate network capable of simultaneously configuring a wireless network service and a sensing device, an AP controller may be additionally included if necessary.

The operation of WIPS to determine the blocking policy may be as follows.

For example, the sensing device 100 monitors a radio frame, and based on the monitored radio frame, the MAC address of the terminal or AP that transmitted it, security settings, frame appearance frequency, transmission rate, data amount, SSID, IEEE 802.11 a Information such as /b/g/n, channel, RSSI, etc. can be processed. In addition, the sensing device 100 may transmit the processed information to the server 130 .

The server 130 may compare the processed information with DB (database)-formed signature information to determine whether the corresponding terminal or AP is unauthorized and whether an abnormal operation occurs. In this case, the signature may include information such as header information of a radio frame or frame occurrence frequency.

The server 130 may determine whether the detected AP is unauthorized in two cases. The server 130 may determine whether the AP is an unauthorized AP based on the SSID, MAC address, and other information stored in the DB, or may determine that the AP is an unauthorized AP if the corresponding AP is not connected to the in-house wired network. In this case, the determination of whether to connect to the in-house wired network may be made in various ways. An unauthorized terminal may also be determined in a similar manner.

When the server 130 determines that the corresponding AP is unauthorized or an AP or terminal operating abnormally, it may automatically block according to a blocking policy or generate an alarm so that the administrator may manually block the block. According to the blocking decision, the server 130 may transmit a blocking target list or blocking policy information to the sensor device 100 .

The sensor device 100 may select an AP and a terminal to be blocked by determination based on the block target list and block policy, and may block.

For example, the blocking of the sensing device 100 based on the blocking target list and blocking policy may be of the following three types.

1) AP blocking: When the BSSID of the blocking target AP is detected, the sensing device 100 may block all terminals accessing the AP rather than a specific terminal target.

2) Terminal Blocking: The sensing device 100 may block the corresponding terminal when it is determined that the terminal is an unauthorized terminal or detects that the corresponding terminal has been tampered with by an authorized terminal. When the MAC of the corresponding terminal appears, the sensing device 100 may block access to all APs thereof.

3) Specific AP-Terminal Blocking: The sensing device 100 may block a connection when an authorized terminal is connected to an unauthorized AP or when an unauthorized terminal is connected to an authorized AP. When the corresponding terminal MAC appears, the sensing device 100 may block only access to a designated AP and may not participate in access to other APs.

For example, the sensing device 100 may include a controller 105 and a communication module 125 .

The communication module 125 may monitor the radio frame and transmit the blocking message to the terminal and the AP when generating the blocking message.

The controller 105 may generate a blocking message related to a wireless frame received as a result of monitoring based on the blocking list and policy information related to wireless intrusion prevention. In addition, the controller 105 may control to transmit the generated blocking message to the AP and the terminal configured to transmit and receive the radio frame.

For example, the controller 105 may include a sensor receiving unit 110 , a sensor analyzing unit 115 , and a sensor blocking unit 120 .

The sensor receiver 110 may control the communication module 125 to monitor radio frames in a plurality of channels.

The sensor analyzer 115 may analyze a radio frame received as a result of monitoring to add/update information of an AP or a terminal that has transmitted the radio frame. The sensor analyzer 115 may generate a blocking event by determining whether the AP or the terminal violates the policy based on the blocking target list and blocking policy. The sensor analyzer 115 may transmit the generated blocking event to the server 130 .

The sensor blocking unit 120 may execute the generated blocking event. The sensor blocking unit 120 may generate a blocking message and transmit it to the AP and the terminal configured to transmit and receive the radio frame.

For example, when the AP and the terminal are connected to each other, the sensor blocking unit 120 may perform blocking by generating a Deauthentication frame and transmitting it to the AP and the terminal. The sensor blocking unit 120 may set the address for sending the non-authentication frame as the BSSID of the AP and the receiving address as the MAC address of the terminal, and may transmit the generated address to the terminal. In addition, the sensor blocking unit 120 may set the address for sending the non-authentication frame as the MAC address of the terminal and the receiving address as the BSSID of the AP to generate and transmit to the AP. The AP and the terminal that have received the non-authentication frame transmitted from the sensing device 100 may determine that the other party has transmitted the non-authentication frame indicating termination of the connection, and may suspend the connection between each other.

2 is a flowchart illustrating a WIPS access blocking method.

The server 130 may transmit wireless intrusion prevention related policy information and a block list to the sensing device 100 in step 205 .

The sensor receiver 110 may monitor radio frames in a plurality of channels in step 210 . When a radio frame is received as a result of monitoring, the sensor receiving unit 110 may call the sensor analyzing unit 115 to analyze the corresponding radio frame in step 215 .

The sensor analyzer 115 may analyze the corresponding radio frame in step 220 and add or update information on the AP or the terminal that has transmitted the radio frame in step 225 . In step 230, it may be determined whether the corresponding AP or the terminal violates the policy. The sensor analyzer 115 may generate a blocking event in step 235 when it is determined that the policy is violated. The sensor analyzer 115 may transmit the blocking event information generated in step 240 to the server 130 .

When it is transmitted to the sensor blocking unit 120 that the blocking event has occurred in step 245 , the sensor blocking unit 120 may execute the blocking event in step 250 . For example, the sensor blocking unit 10 may generate an unauthenticated frame as described above and transmit it to the AP and the terminal configured to transmit and receive the radio frame.

3 is a flowchart illustrating a method of determining, by the sensor analyzer 115 in a sensing device (eg, 100), whether a policy is violated based on a monitored radio frame.

The sensor analyzer 115 may analyze the radio frame in step 305 and add/update information on the AP or the terminal that has transmitted the radio frame.

The sensor analysis unit 115 may determine whether the monitored AP or terminal is on the blocked AP list in step 310, and if it is on the list, block to block the connection between the AP and the terminal related to the radio frame in step 315 You can create events.

The sensor analysis unit 320 may determine whether the monitored AP or terminal is in the blocked terminal list in step 320, and if it is in the list, block to block the connection between the AP and the terminal related to the radio frame in step 325 You can create events.

The sensor analyzer 320 may determine whether the monitored AP has violated the unauthorized AP policy in step 330, and if it is determined that the violation has been violated, in step 335 for blocking the connection between the AP and the terminal related to the radio frame A blocking event can be generated.

The sensor analysis unit 320 may determine whether the monitored terminal has violated the unauthorized terminal policy in step 340, and when it is determined that the violation is determined in step 345, to block the connection between the AP and the terminal related to the radio frame in step 345 A blocking event can be generated.

The sensor analysis unit 320 may determine whether the monitored AP or terminal has violated other policies in step 350, and if it is determined that the violation has been violated, block the connection between the AP and the terminal related to the radio frame in step 355 You can create a blocking event for

On the other hand, with the advent of technologies with enhanced security for radio frames such as IEEE 802.11w, the following problems with the WIPS AP-terminal access blocking method have emerged.

Since the existing IEEE 802.11 management frame was transmitted in an unprotected state, the AP or the terminal accepted the unauthenticated frame sent from the sensor without any doubt and stopped the connection between them. However, as IEEE 802.11w defines a technology for protecting the management frame, the AP or UE connected to IEEE 802.11w ignores the non-authentication frame if it is not a protected non-authentication frame. Blocking cannot be performed through

Therefore, when the AP and the terminal attempt to access via IEEE 802.11w, since the time between the AP and the terminal is faster than the time for generating a blocking message after the policy check, the blocking cannot be performed normally.

Accordingly, various embodiments of the present invention provide a method of quickly detecting an AP and a terminal attempting to access by IEEE 802.11w in WIPS and performing blocking between the AP and the terminal according to the blocking policy and block list of WIPS. . The description below will be described as an example of a wireless network to which IEEE 802.11w is applied, but is not limited thereto, and it will be well understood that the wireless network can be extended and applied to a wireless network to which a predetermined security technology is applied to a wireless frame.

4 is a block diagram showing a schematic configuration of a WIPS according to an embodiment of the present invention.

Referring to FIG. 4 , the WIPS according to an embodiment of the present invention may include a sensing device 400 and a server 440 .

Similar to the operation described above with reference to FIG. 1 , the server 440 may determine a blocking target list and blocking policy information and transmit it to the sensing device 400 .

The sensing device 400 may include a controller 405 and first and second communication modules 430 and 435 .

The first and second communication modules 430 and 435 according to an embodiment of the present invention may perform a function of monitoring a radio frame and a function of transmitting the generated blocking message to the AP and the terminal separately. For example, the first communication module 430 may sequentially monitor radio frames in a plurality of channels under the control of the controller 405 . In addition, the second communication module 435 may transmit the generated blocking message to the AP and the terminal under the control of the controller 405 . Since the communication module that performs the monitoring function and the communication module that transmits the blocking message are separated, faster monitoring and blocking operations are possible, and thus high blocking performance can be expected.

Referring to FIG. 5 , the configuration of the communication module included in the sensing device 500 illustrated in FIG. 1 may be compared with the configuration of the communication module included in the sensing device 520 illustrated in FIG. 4 .

For example, in the case of the sensing device 500 that does not consider IEEE 802.11w, for example, the communication module 505 for performing channel scan and blocking for the 2.4 GHz band and the communication module for performing the channel scan and blocking for the 5 GHz band 510 may be included.

On the other hand, in the case of the sensing device 500 considering IEEE 802.11w, a communication module 525 for performing a channel scan and a communication module 530 for performing a blocking may be separately included. As an example, the communication module 525 performing a channel scan may perform a channel scan for a 2.4 GHz band and a 5 GHz band. In addition, the communication module 530 for performing blocking may include communication modules 535 and 540 for performing blocking for each of the 2.4 GHz band and the 5 GHz band.

The controller 405 may generate a blocking message related to the radio frame received as a result of monitoring based on the block list and the policy information received from the server 440 .

In this case, the controller 405 separately filters the radio frame to which a predetermined radio network technology (eg, IEEE 802.11w) is applied, and generates a block message for the radio frame and blocks the radio frame to which the general radio network technology is applied. The operation of generating a message can be processed in parallel. In addition, the controller 105 may control to transmit the generated blocking message to the AP and the terminal configured to transmit and receive the radio frame.

The following is a description of a concept added in an embodiment of the present invention in relation to IEEE 802.11w.

1) PMF (Protected Management Frame)

In the existing wireless LAN, only data frames could be protected, and management frames and control frames were not protected, but IEEE 802.11w established a technology that can protect some management frames as a standard, which is called PMF. These frame types include de-authentication, disassociation and action management frame.

2) Protected flag

In order to block access by IEEE 802.11w according to an embodiment of the present invention, it is necessary to check the de-authentication and disassociation messages between the AP and the terminal being connected. However, since there is no field for distinguishing IEEE 802.11w in the case of de-authentication and disassociation messages, it is necessary to estimate whether connection to IEEE 802.11w is possible. There is a Protected flag in the radio tap flag, and when this value is 1, it can be estimated that the AP and the terminal that were previously connected performed data encryption (WEP, WPA/WPA2).

3) 11w scan algorithm

According to an embodiment of the present invention, radio frame monitoring proposes an algorithm that increases the probability of scanning an 11w channel by dynamically allocating a channel to a channel for which IEEE 802.11w is detected.

4) Management Frame Protection Required (MFPR)

An AP or UE supporting IEEE 802.11w emits MFPR in the RSN capabilities field of the Robust Security Network (RSN) Information Element (IE) as a Beacon or Probe message. When the MFPR bit is 1, the corresponding AP or terminal can connect with the other party only through IEEE 802.11w. When the bit of MFPR is 0, it may be determined whether to connect to 802.11w with the MFPC described in 5) below.

5) Management Frame Protection Capable (MFPC)

An AP or UE supporting 802.11w emits the MFPC in the RSN capabilities field described in 4) as a beacon or probe message. When the bit of MFPC is 1, the corresponding AP or terminal becomes an option to connect with the other party through IEEE 802.11w. If the bit of MFPC is 0, the corresponding AP or terminal does not connect with the other party through IEEE 802.11w.

6) Whether IEEE 802.11w is possible according to MFPR and MFPC settings

The AP or the UE may distinguish between MFPC and MFPR in case of supporting IEEE 802.11w connection and MFPC and MFPR in case of not supporting IEEE 802.11w. According to each option, as follows, it is possible to check whether the AP or the terminal is connected to the other party by 802.11w.

AP terminal 802.11w connection or not MFPC=0, MFPR=0 MFPC=0, MFPR=0 X MFPC=0, MFPR=0 MFPC=1, MFPR=0 X MFPC=0, MFPR=0 MFPC=1, MFPR=1 X MFPC=1, MFPR=0 MFPC=0, MFPR=0 X MFPC=1, MFPR=0 MFPC=1, MFPR=0 O MFPC=1, MFPR=0 MFPC=1, MFPR=1 O MFPC=1, MFPR=1 MFPC=0, MFPR=0 X MFPC=1, MFPR=1 MFPC=1, MFPR=0 O MFPC=1, MFPR=1 MFPC=1, MFPR=1 O

An operation of the controller 405 will be described below on the premise that the above-described IEEE 802.11w related technology is applied.

As an example, the controller 405 may include a sensor receiver 410 , a first sensor analyzer 415 , a second sensor pumice part 420 , and a sensor blocker 425 . This configuration of the controller 405 may be a software classification or a hardware classification. The configuration of the controller 405 is not limited thereto, and may be designed in various ways to implement the same function.

The sensor receiver 410 may control the first communication module 125 to monitor radio frames in a plurality of channels. As will be described in detail below, the sensor receiver 410 may dynamically additionally allocate a channel to which an IEEE 802.11w radio frame is transmitted among the plurality of channels for the monitoring.

The first sensor analyzer 415 filters the IEEE 802.11w radio frame among the at least one radio frame received as a result of the monitoring, and generates a blocking event for the filtered radio frame based on the block target list and block policy can do. Meanwhile, when policy application for IEEE 802.11w is in a deactivated state, the first sensor analyzer 415 may generate policy violation prediction information for the radio frame. If the policy application is activated later, the first sensor analyzer 415 may generate a blocking event for the radio frame based on the policy violation prediction information.

When the radio frame is a beacon frame, the first sensor analyzer 415 generates a fake beacon with forged channel information and transmits it to the terminal, thereby delaying the access of unspecified terminals to the AP supporting IEEE 802.11w. can

When the radio frame is a probe frame, the first sensor analyzer 415 may generate a blocking event for the radio frame.

The second sensor analysis unit 420 determines whether at least one radio frame received as a result of the monitoring violates the policy based on the blocking target list and the blocking policy, and receives the IEEE 802.11w radio frame according to the determination result. It is possible to generate a blocking event for the excluded radio frame.

By operating in parallel, the first and second sensor analyzers 420 may generate a blocking event for an IEEE 802.11w radio frame more quickly.

The sensor blocking unit 425 may execute blocking events generated by the first and second sensor analysis units 420 . The sensor blocking unit 425 may generate a blocking message based on the blocking event and transmit it to the AP and the terminal configured to transmit and receive the radio frame.

6 is a flowchart illustrating a WIPS access blocking method according to an embodiment of the present invention.

The server 440 may transmit wireless intrusion prevention related policy information and a block list to the sensing device 400 in step 605 .

The sensor receiver 410 may sequentially monitor radio frames in a plurality of channels in step 610 . The sensor receiver 410 may dynamically allocate a scan channel when monitoring a radio frame as shown in FIG. 7 . The sensor receiver 410 may initially allocate a scan channel as shown in 705 to sequentially monitor radio frames. Thereafter, when an IEEE 802.11w-related channel (eg, channel 5) is detected, it may be managed to additionally allocate a corresponding channel for monitoring as shown in 710. In addition, when an additional IEEE 802.11w-related channel (eg, channel 157) is detected, it may be managed to additionally allocate a corresponding channel as in 715 for monitoring. Accordingly, a blocking event related to a radio frame of IEEE 802.11w can be performed more quickly by frequently performing a scan for an IEEE 802.11w-related channel.

As a result of monitoring, when a radio frame is received, the sensor receiving unit 410 may call the first sensor analyzing unit 415 to analyze the corresponding radio frame in step 615 .

The first sensor analyzer 415 may analyze the filtered radio frame by filtering the IEEE 802.11w radio frame in step 620 . Then, in step 625 , the first sensor analyzer 415 determines whether the policy is violated for the radio frame if the IEEE 802.11w related policy application is activated, and if the IEEE 802.11w related policy application is deactivated, the corresponding It is possible to generate policy violation prediction information for the radio frame. When the IEEE 802.11w-related policy application is activated later, the first sensor analyzer 415 may generate a blocking event more quickly based on the policy violation prediction information.

The first sensor analyzer 415 may generate a blocking event based on a result of determining whether the policy is violated in step 630 . For example, when the corresponding radio frame is a beacon message, the first sensor analyzer 415 may generate and transmit a fake beacon to the terminal, thereby delaying the terminal's access to the AP. When the radio frame is a probe message, the first sensor analyzer 415 may generate a blocking event for the radio frame.

The first sensor analyzer 415 may transmit the blocking event information generated in step 635 to the server 440 . In step 640 , the occurrence of a blocking event may be transmitted to the sensor blocking unit 425 .

Meanwhile, when a radio frame is received as a result of the monitoring, the sensor receiving unit 410 may call the second sensor analyzing unit 420 to analyze the corresponding radio frame in step 645 .

The second sensor analyzer 420 may analyze the received radio frame in step 650 . In this case, the second sensor analyzer 420 may analyze including the IEEE 802.11w radio frame. However, tagging may be performed on the IEEE 802.11w radio frame so that the generation of the block event for the IEEE 802.11w radio frame may be excluded when the block event is generated later.

Meanwhile, the second sensor analyzer 420 may deliver a notification of the corresponding channel to the sensor receiver 410 when an IEEE 802.11w radio frame is detected for dynamic allocation of the scan channel described above.

The second sensor analyzer 420 may add or update information on the AP or the terminal that has transmitted the corresponding radio frame in step 655 . In step 660, it may be determined whether the policy of the corresponding AP or terminal is violated. The second sensor analyzer 420 may generate a blocking event in step 665 when it is determined that the policy is violated. In this case, a blocking event may be generated only for radio frames except for the tagged IEEE 802.11w radio frame.

The second sensor analyzer 420 may transmit the blocking event information generated in step 670 to the server 440 . In step 675 , the occurrence of the blocking event may be transmitted to the sensor blocking unit 425 .

The sensor blocking unit 425 may execute the blocking event transmitted from the first and second sensor analysis units 415 and 420 in step 680 . The sensor blocking unit 425 may, for example, generate a blocking message and transmit it to the AP and the terminal configured to transmit and receive the radio frame.

8 is a flowchart illustrating a method for dynamically allocating a scan channel when monitoring a radio frame by the sensor receiver 410 according to an embodiment of the present invention.

The sensor receiver 410 may receive a radio frame in step 805 . In step 810 , the sensor receiver 410 may determine whether IEEE 802.11w-related policy application is activated.

If policy application is activated, the sensor receiving unit 410 may check whether the channel receiving the radio frame is an IEEE 802.11w channel of the AP that is not currently managed as an additional scan channel in step 815 . If it is a channel managed as an additional scan channel, it is ignored. However, if the channel is not managed as an additional scan channel, the sensor receiver 410 may additionally allocate the corresponding channel as the scan channel in step 820 .

On the other hand, if policy application is deactivated, the sensor receiver 410 may delete all IEEE 802.11w scan channels currently managed as additional scan channels in step 825 .

9 is a flowchart illustrating a method for the first sensor analyzer 415 to generate a radio frame-related blocking event supporting IEEE 802.11w according to an embodiment of the present invention.

The first sensor analyzer 415 may receive a frame analysis call in step 905 .

The first sensor analyzer 415 may determine whether the corresponding radio frame is a beacon message in step 910 .

When the corresponding radio frame is a beacon message, the first sensor analyzer 415 may check whether the corresponding radio frame supports IEEE 802.11w in step 915 . If it is a radio frame that does not support IEEE 802.11w, it can be discarded and the detected radio frame can be analyzed next.

If it is determined as a beacon message supporting IEEE 802.11w, the first sensor analyzer 415 may determine whether IEEE 802.11w-related policy application is activated in step 920 .

If policy application is activated, the first sensor analyzer 415 may generate a fake beacon in which channel information is forged when the corresponding radio frame violates the policy in step 925 . Radio frames that do not violate the policy may be discarded. On the other hand, if policy application is deactivated, the first sensor analyzer 415 may generate policy violation prediction information by checking whether the radio frame is expected to violate the policy in step 930 . Therefore, when policy application is activated later, a fake beacon may be quickly generated based on the policy violation expected information.

On the other hand, if the corresponding radio frame is not a beacon message, the first sensor analyzer 415 may determine whether the corresponding radio frame is a probe message in step 935 . If it is not a probe message, the first sensor analyzer 415 may discard it and analyze the next detected radio frame.

When the corresponding radio frame is a probe message, the first sensor analyzer 415 may check whether the corresponding radio frame supports IEEE 802.11w in step 915 . If it is a radio frame that does not support IEEE 802.11w, it may be discarded and the detected radio frame may be analyzed next.

If it is identified as a probe message supporting IEEE 802.11w, the first sensor analyzer 415 may determine whether IEEE 802.11w-related policy application is activated in step 945 .

If the policy application is activated, the first sensor analyzer 415 may generate a blocking event for the corresponding radio frame when the policy is violated in step 950 . Radio frames that do not violate the policy may be discarded. On the other hand, if policy application is deactivated, the first sensor analyzer 415 may generate policy violation prediction information by checking whether the radio frame is expected to violate the policy in step 955 . Therefore, when policy application is activated later, a blocking event may be generated promptly based on the policy violation expected information.

That is, according to an embodiment of the present invention, the first sensor analyzer 415 may store policy violation information of the AP and the terminal related to IEEE 802.11w regardless of whether policy application is activated from the server. The policy violation information may be continuously stored while updating the validity period. The stored information may be used in case the AP and the UE attempting to connect to IEEE 802.11w are not detected in the probe message. That is, if the probe message is later detected and the blocking message is not generated to the corresponding AP and the terminal, the blocking message may be generated based on the stored policy violation information.

10 is a flowchart illustrating a method for the second sensor analyzer 420 to generate a radio frame-related blocking event according to an embodiment of the present invention.

The second sensor analyzer 420 may analyze the radio frame in step 1005 and add/update information on the AP or the terminal that has transmitted the radio frame.

The second sensor analyzer 420 may determine whether the monitored AP or terminal supports IEEE 802.11w in step 1010, and if it does, tagging the AP and terminal information related to the radio frame in step 1015 ) can be done.

The second sensor analysis unit 420 may determine whether the monitored AP or terminal is on the blocked AP list in step 1020, and if it is on the list, block the connection between the AP and the terminal related to the radio frame in step 1025 You can create a blocking event for

The second sensor analysis unit 420 may determine whether the monitored AP or terminal is in the blocked terminal list in step 1030, and if it is in the list, block the connection between the AP and the terminal related to the radio frame in step 1035 You can create a blocking event for

The second sensor analysis unit 420 may determine whether the monitored AP has violated the unauthorized AP policy in step 1040, and if it is determined that the violation has been violated, block the connection between the AP and the terminal related to the radio frame in step 1045 You can create a blocking event to do this. In this case, blocking events for APs and terminals tagged as supporting IEEE 802.11w may be excluded.

The second sensor analysis unit 420 may determine whether the monitored terminal has violated the unauthorized terminal policy in step 1050, and if it is determined that the violation has been violated, in step 1055, the connection between the AP and the terminal related to the radio frame is blocked You can create a blocking event to do this. In this case, blocking events for APs and terminals tagged as supporting IEEE 802.11w may be excluded.

The second sensor analysis unit 420 may determine whether the monitored AP or the terminal violates other policies in step 1060, and if it is determined that the violation has been violated, in step 1065, the connection between the AP and the terminal related to the radio frame You can create a blocking event to block. In this case, blocking events for APs and terminals tagged as supporting IEEE 802.11w may be excluded.

Meanwhile, the order of determination for generating the blocking event is arbitrarily determined, and the order may be partially changed.

That is, according to an embodiment of the present invention, the second sensor analyzer 420 tags the AP or terminal information supporting IEEE 802.11w, so that the second sensor analyzer 420 performs the first sensor analyzer 415 ) and prevents the generation of a blocking event for a radio frame supporting IEEE 802.11w.

Embodiments of the present disclosure disclosed in the present specification and drawings are merely provided for specific examples to easily explain the technical content of the present disclosure and help the understanding of the present disclosure, and are not intended to limit the scope of the present disclosure. Therefore, the scope of the present disclosure should be construed as including all changes or modifications derived from the technical spirit of the present disclosure in addition to the embodiments disclosed herein as being included in the scope of the present disclosure.

Claims (20)

In a method of blocking access of an electronic device in a wireless intrusion prevention system,
using the first communication module to monitor radio frames in a plurality of channels;
generating a first blocking message based on at least one radio frame and generating a second blocking message based on a first radio frame to which a predetermined security technology is applied in parallel; and
using a second communication module to transmit at least one of the first or second blocking message;
The at least one radio frame belongs to a radio frame determined to violate a policy among the monitored radio frames except for the first radio frame.
The method of claim 1,
The monitoring step is
and dynamically allocating a channel through which the first radio frame is transmitted among the plurality of channels for the monitoring.
The method of claim 1,
The step of generating the first blocking message comprises:
and determining whether a policy is violated for each of the at least one radio frame based on policy information and a block list.
The method of claim 1,
The step of generating the second blocking message comprises:
generating a fake beacon message having a characteristic different from that of the beacon message when the policy application related to the predetermined security technology is activated when the first radio frame is a beacon message; and
and transmitting the fake beacon message to a terminal.
5. The method of claim 4,
The step of generating the second blocking message comprises:
generating policy violation prediction information for the first radio frame when policy application related to the predetermined security technology is inactive when the first radio frame is a beacon message;
The method further comprising the step of generating the fake beacon message based on the expected information when the application of the policy related to the predetermined security technology is activated later.
The method of claim 1,
The step of generating the second blocking message comprises:
and generating the second blocking message when policy application related to the predetermined security technology is activated when the first radio frame is a probe message.
7. The method of claim 6,
The step of generating the second blocking message comprises:
generating policy violation prediction information for the first radio frame when policy application related to the predetermined security technology is inactive when the first radio frame is a probe message;
The method further comprising the step of generating the second blocking message based on the expected information when the application of the policy related to the predetermined security technology is activated later.
The method of claim 1,
The method of blocking access of an electronic device further comprising the step of receiving wireless intrusion prevention-related policy information and a block list from a server.
delete The method of claim 1,
The predetermined security technology includes an IEEE 802.11w security technology.
In an electronic device in a wireless intrusion prevention system,
a first communication module;
a second communication module; and
Control to monitor radio frames in a plurality of channels using the first communication module, generate a first block message based on at least one radio frame, and generate a second block message based on a first radio frame to which a predetermined security technology is applied. and a controller that controls generation to be performed in parallel, and controls to transmit at least one of the first or second blocking message using a second communication module,
The at least one radio frame belongs to a radio frame determined to violate a policy among the monitored radio frames except for the first radio frame.
12. The method of claim 11,
The controller is
and dynamically allocating a channel through which the first radio frame is transmitted among the plurality of channels for the monitoring.
12. The method of claim 11,
The controller is
The electronic device of claim 1, wherein it is determined whether a policy is violated for each of the at least one radio frame based on policy information and a block list.
12. The method of claim 11,
The controller is
When the first radio frame is a beacon message, if the policy application related to the predetermined security technology is activated, a fake beacon message having a characteristic different from that of the beacon message is generated, and the fake beacon message is transmitted to the terminal An electronic device comprising the steps.
15. The method of claim 14,
The controller is
When the first radio frame is a beacon message, policy violation prediction information for the first radio frame is generated when policy application related to the predetermined security technology is inactive, and when policy application related to the predetermined security technology is activated later, the and generating the fake beacon message based on expected information.
12. The method of claim 11,
The controller is
The electronic device of claim 1, wherein when the first radio frame is a probe message and the policy application related to the predetermined security technology is activated, the second blocking message is generated.
17. The method of claim 16,
The controller is
When the first radio frame is a probe message, policy violation prediction information for the first radio frame is generated when policy application related to the predetermined security technology is inactive, and when policy application related to the predetermined security technology is activated later, the and generating the second blocking message based on expected information.
12. The method of claim 11,
The controller is
An electronic device, characterized in that it controls to receive wireless intrusion prevention-related policy information and a block list from a server.
delete 12. The method of claim 11,
The electronic device according to claim 1, wherein the predetermined security technology includes a security technology of IEEE 802.11w.

Images